Review TP_5GNAS_AMF_AUT_REQ_05 and TC_5GNAS_AMF_AUT_REQ_05 (ccceaa6a) · Commits · INT - Core Network and Interoperability Testing / 5G Core / NAS

captures/TC_5GNAS_AMF_AUT_REQ_05.pcap

0 → 100644

+4.13 KiB

File added.

No diff preview for this file type.

etc/Ats_NG_NAS/Ats_NG_NAS_AMF_open5gs.cfg_

+3 −2

Changes for etc/Ats_NG_NAS/Ats_NG_NAS_AMF_open5gs.cfg_: 3 added lines, 2 removed lines.
Original line number	Diff line number	Diff line
		@@ -14,6 +14,7 @@ NGAP_Pics.PICS_NGAP_GNB_IUT := false
		NG_NAS_Pics.PICS_NGNAS := true
		NG_NAS_Pics.PICS_NAS_A4_1_2 := true # 5G AKA based primary authentication and key agreement (TC_5GNAS_AMF_AUT_REQ_xx)
		NG_NAS_Pics.PICS_NAS_A4_1_2_2_1 := false # open5gs: AUTHENTICATION REJECT on #20 MAC failure, no identification (TC_5GNAS_AMF_AUT_REQ_04)
		NG_NAS_Pics.PICS_NAS_A4_1_2_4 := true # open5gs re-authenticates on #71 ngKSI already in use (TC_5GNAS_AMF_AUT_REQ_05)

		LibNGAP_Pics.PICS_OFFLINE_MODE := false # true to use offline mode with pcap files, false to use online mode with real network functions
		LibNGAP_Pics.PICS_USE_OPEN5GS := false # true to start open5gs, false to not start them
		@@ -175,9 +176,9 @@ system.utHttpPort.params := "HTTP/TCP(server=127.0.0.1,port=12200,use_ssl=0,debu
		# Verify that the IUT stops re-sending an AUTHENTICATION_REQUEST message if no AUTHENTICATION_RESPONSE message is received on the fifth expire of timer T3560
		#NG_NAS_TestCases.TC_5GNAS_AMF_AUT_REQ_03
		# Verify that the IUT sends an IDENTITY_REQUEST message correctly upon receipt of an AUTHENTICATION_FAILURE message indicating a 5GMM cause value #20 - MAC failure
		NG_NAS_TestCases.TC_5GNAS_AMF_AUT_REQ_04
		#NG_NAS_TestCases.TC_5GNAS_AMF_AUT_REQ_04
		# Verify that the IUT sends a new AUTHENTICATION_REQUEST message with new ngKSI value to re-initiate the 5G AKA based primary authentication upon receipt of an AUTHENTICATION_FAILURE message indicating a 5GMM cause value #71 - ngKSI already in use
		#NG_NAS_TestCases.TC_5GNAS_AMF_AUT_REQ_05
		NG_NAS_TestCases.TC_5GNAS_AMF_AUT_REQ_05
		# Verify that the IUT sends an IDENTITY_REQUEST message to obtain the SUCI from the UE upon receipt of an AUTHENTICATION_FAILURE message indicating a 5GMM cause value #26 - non-5G authentication unacceptable
		#NG_NAS_TestCases.TC_5GNAS_AMF_AUT_ABN_01
		# Verify that the IUT sends a SECURITY MODE COMMAND message correctly to indicate NAS security mode procedure upon receipt of a NAS AUTHENTICATION RESPONSE

test_purposes/TP_AMF_NGNAS.tdltx

+10 −7

Changes for test_purposes/TP_AMF_NGNAS.tdltx: 10 added lines, 7 removed lines.
Original line number	Diff line number	Diff line
		@@ -204,6 +204,7 @@ Package TP_AMF_NGNAS {

		Configuration: CF_AMF_N2N1

		PICS: PICS_NAS_A4_1_2_4

		Initial conditions
		with {
		@@ -214,9 +215,10 @@ Package TP_AMF_NGNAS {
		security_header_type set to NOT_SECURITY_PROTECTED,
		message_type set to AUTHENTICATION_REQUEST,
		ngKSI containing {
		nas_key_set_identifier set to "111"}, //!value for nas_key_set_identifier was already used before
		type_of_security_context set to NATIVE_SECURITY_CONTEXT,
		nas_key_set_identifier set to RV_NGKSI}, //!any value other than "111" (reserved from network to UE); the UE claims it is already associated with a 5G security context it stores
		ABBA containing {
		ABBA_contents set to " '0000'H "},
		ABBA_contents set to " '0000'O "},
		Authentication_parameter_RAND set to RV_Authentication_parameter_RAND,
		Authentication_parameter_AUTN set to RV_Authentication_parameter_AUTN}}
		to the GNB entity
		@@ -228,7 +230,7 @@ Package TP_AMF_NGNAS {
		the IUT entity receives an UPLINK_NAS_TRANSPORT containing {
		NAS_PDU containing {
		extended_protocol_discriminator set to 5GS_MOBILITY_MANAGEMENT_MESSAGES, //!reference ts_124007v180200p: Table 11.2.3.1.1A.1: EPD values
		security_header_type set to INTEGRITY_PROTECTED,
		security_header_type set to NOT_SECURITY_PROTECTED, //!no 5G NAS security context yet
		message_type set to AUTHENTICATION_FAILURE,
		5GMM_cause set to ngKSI_already_in_use}}
		from the GNB entity
		@@ -240,11 +242,12 @@ Package TP_AMF_NGNAS {
		security_header_type set to NOT_SECURITY_PROTECTED,
		message_type set to AUTHENTICATION_REQUEST,
		ngKSI containing {
		nas_key_set_identifier set to PX_NON_DEFAULT_NGKSI},
		type_of_security_context set to NATIVE_SECURITY_CONTEXT,
		nas_key_set_identifier set to RV_NGKSI_NEW}, //!new ngKSI: different from RV_NGKSI and from "111"
		ABBA containing {
		ABBA_contents set to " '0000'H "},
		Authentication_parameter_RAND set to RV_Authentication_parameter_RAND,
		Authentication_parameter_AUTN set to RV_Authentication_parameter_AUTN}}
		ABBA_contents set to " '0000'O "},
		Authentication_parameter_RAND set to RV_Authentication_parameter_RAND, //!same 5G authentication challenge as the initial AUTHENTICATION_REQUEST (ETSI TS 124 501 clause 5.4.1.3.7 e))
		Authentication_parameter_AUTN set to RV_Authentication_parameter_AUTN}} //!same as the initial AUTHENTICATION_REQUEST
		to the GNB entity
		}
		}

ttcn/Ats_NG_NAS/NG_NAS_Pics.ttcn

+7 −0

Changes for ttcn/Ats_NG_NAS/NG_NAS_Pics.ttcn: 7 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -31,6 +31,13 @@ module NG_NAS_Pics {
		*/
		modulepar boolean PICS_NAS_A4_1_2_2_1 := false;

		/**
		* @desc Does the IUT re-initiate the 5G AKA based primary authentication on receipt of an AUTHENTICATION FAILURE message
		* containing 5GMM cause #71 "ngKSI already in use"? (TS 24.501 clause 5.4.1.3.7 e))
		* @see ETSI TS 103 921-1 Table A.4 (PICS_NAS_A4_1_2_4)
		*/
		modulepar boolean PICS_NAS_A4_1_2_4 := true;

		} // End of group PICS_

		} // End of module NG_NAS_Pics
		No newline at end of file

ttcn/Ats_NG_NAS/NG_NAS_TCFunctions.ttcn

+51 −74

Changes for ttcn/Ats_NG_NAS/NG_NAS_TCFunctions.ttcn: 51 added lines, 74 removed lines.
Original line number	Diff line number	Diff line
		@@ -366,97 +366,74 @@ module NG_NAS_TCFunctions {

		/**
		* @desc Testcase function for TC_5GNAS_AMF_AUT_REQ_05
		* @see TP_5GNAS_AMF_AUT_REQ_05: an AUTHENTICATION FAILURE with 5GMM cause #71 "ngKSI already in use" is answered
		* by a new plain AUTHENTICATION REQUEST with a new native ngKSI and the same 5G authentication challenge
		* (same RAND and AUTN, TS 24.501 clause 5.4.1.3.7 e)).
		*/
		function f_TC_5GNAS_AMF_AUT_REQ_05() runs on aMF_NGNAS_NGAPComponent {
		// Local variables
		const NAS_CauseValue_Type c_cause_ngKSI_already_in_use := '01000111'B; // 5GMM cause #71
		var NG_NAS_DL_Message_Type v_first;
		var NG_NAS_DL_Message_Type v_message;
		var NGAP_PDU v_PDU;
		var boolean v_released := false;

		// Preamble
		// Preamble: NG SETUP, initial REGISTRATION REQUEST with the SUCI, AUTHENTICATION REQUEST
		f_NGNAS_amf_init();
		f_NG_NAS_amf_UE_Register();
		action("Send invalid response to trigger NAS authentication failure and verify that AMF initiates a new authentication procedure with new KSI value");
		if (not f_NG_NAS_amf_await_AuthenticationRequest(0.0, PX_TNOAC, v_first)) {
		setverdict(inconc, "* " & __SCOPE__ & ": INCONC: no AUTHENTICATION REQUEST *");
		}
		f_selfOrClientSyncAndVerdict(c_prDone, f_getVerdict());
		log("* " & __SCOPE__ & ": INFO: Preamble done. *");

		// Test Body
		// Await AuthenticationRequest
		f_recv_NGAP_PDU(
		mw_ngap_initMsg(
		mw_n2_DownlinkNASTransport(
		?,
		vc_RAN_UE_ID,
		? // AuthorizationRequest
		)));
		f_NASPDU_Get(vc_recvNGAP_PDU);
		var NG_NAS_DL_Message_Type v_message;
		if (f_Check_5GAKA_NAS_DL_Message(
		vc_recvNAS_PDU,
		mw_NG_AUTHENTICATION_REQUEST(
		?,
		-,
		mw_GMM_AuthRAND,
		mw_GSM_AUTN
		),
		vc_ng_nas_security_params_type,
		vc_previous_nas_count_dl,
		v_message,
		vc_inner_message
		) == false) {
		log("* " & __SCOPE__ & ": FAIL: Unexpected NG_AUTHENTICATION_REQUEST *");
		setverdict(fail);
		return;
		f_NG_NAS_amf_UE_AuthenticationFailure(c_cause_ngKSI_already_in_use);
		if (not f_NG_NAS_amf_await_AuthenticationRequest(0.0, PX_TNOAC, v_message)) {
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: no new AUTHENTICATION REQUEST after the AUTHENTICATION FAILURE #71 *");
		} else if (not match(v_message.authentication_Request.ngNasKeySetId,
		cr_NAS_KeySetIdentifier(complement(v_first.authentication_Request.ngNasKeySetId.nasKeySetId, tsc_NasKsi_NoKey), tsc_NasKsi_NativeSecurityContext))) {
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: the new AUTHENTICATION REQUEST does not carry a new native ngKSI *");
		} else if ((v_message.authentication_Request.rand != v_first.authentication_Request.rand) or
		(v_message.authentication_Request.autn != v_first.authentication_Request.autn)) {
		setverdict(fail, "* " & __SCOPE__ & ": FAIL: the new AUTHENTICATION REQUEST does not carry the same 5G authentication challenge (RAND, AUTN) *");
		} else {
		log("* " & __SCOPE__ & ": PASS: Expected NG_AUTHENTICATION_REQUEST *");
		log("*** " & __SCOPE__ & ": PASS: new AUTHENTICATION REQUEST, ngKSI ", v_first.authentication_Request.ngNasKeySetId.nasKeySetId,
		" -> ", v_message.authentication_Request.ngNasKeySetId.nasKeySetId, ", same challenge ***");
		setverdict(pass);
		}
		// Send error message
		vt_NgNasUl_Msg := m_NG_AUTHENTICATION_FAILURE(
		m_GMM_GSM_Cause(
		-,
		int2bit(71, 8) // ngKSI already in use
		));
		vc_sendNAS_PDU := bit2oct(encvalue(valueof(vt_NgNasUl_Msg)));
		f_send_NGAP_PDU(
		m_ngap_initMsg(
		m_n2_UplinkNASTransport(
		-,
		-,
		vc_sendNAS_PDU,
		m_uPTransportLayerInformation_userLocationInformationNR(
		m_userLocationInformationNR(
		m_nR_CGI,
		m_tAI
		)))));
		// Await new AuthenticationRequest due to authentication failure
		f_recv_NGAP_PDU(
		mw_ngap_initMsg(
		mw_n2_DownlinkNASTransport(
		?,
		vc_RAN_UE_ID,
		?
		)));
		f_NASPDU_Get(vc_recvNGAP_PDU);
		if (f_Check_5GAKA_NAS_DL_Message(
		vc_recvNAS_PDU,
		mw_NG_AUTHENTICATION_REQUEST(
		complement(vc_ngKSI)
		),
		vc_ng_nas_security_params_type,
		vc_previous_nas_count_dl,
		v_message,
		vc_inner_message
		) == false) {
		log("* " & __SCOPE__ & ": FAIL: Unexpected NG_IDENTITY_REQUEST *");
		setverdict(fail);
		} else {
		log("* " & __SCOPE__ & ": PASS: Expected NG_IDENTITY_REQUEST *");
		setverdict(pass);
		log("* " & __SCOPE__ & ": INFO: RAND ", v_first.authentication_Request.rand, " -> ", v_message.authentication_Request.rand, " *");
		// A release of the UE context by the IUT is received before the synchronisation, where a_defaultNGAP would discard it
		tc_noac.start(1.0);
		alt {
		[] N2_gNBaMF_P.receive(mw_ngap_initMsg_anyProcedure(id_UEContextRelease)) -> value v_PDU {
		tc_noac.stop;
		f_NGAPPDU_Get(v_PDU);
		v_released := true;
		log("* " & __SCOPE__ & ": INFO: the IUT releases the UE context *");
		}
		[] tc_noac.timeout { }
		}
		f_selfOrClientSyncAndVerdict(c_tbDone, f_getVerdict());
		log("* " & __SCOPE__ & ": INFO: Testbody done. *");

		// Postamble
		// Terminate call with rejection
		f_send_error_indication(m_cause_nas(authentication_failure));
		// Postamble: release of the UE context
		if (v_released) {
		if (PICS_OFFLINE_MODE) {
		f_recv_NGAP_PDU(mw_ngap_succMsg_anyProcedure(id_UEContextRelease));
		} else {
		f_send_NGAP_PDU(
		m_ngap_succMsg(
		f_m_n2_UEContextReleaseComplete(
		vc_AMF_UE_ID,
		vc_RAN_UE_ID
		)));
		}
		} else if (PICS_OFFLINE_MODE) {
		f_await_ue_context_release_request_await_ue_context_release_response(m_cause_nas(normal_release));
		} else {
		f_send_ue_context_release_request_await_ue_context_release_response(m_cause_nas(normal_release));
		}
		f_postamble_NGAP_AMF();
		f_selfOrClientSyncAndVerdict(c_poDone, f_getVerdict());
		log("* " & __SCOPE__ & ": INFO: Postamble done. *");